The vulnerability is a Dockerfile instruction injection flaw in BentoML prior to version 1.4.39. By embedding newline characters in the keys of the docker.env mapping, an attacker can supply a crafted bentofile.yaml or a malicious bento archive that causes BentoML's containerization process to render additional Dockerfile instructions. These injected RUN commands are executed during the build, allowing the attacker to access build secrets, modify the image contents, and introduce arbitrary code. The weakness corresponds to OS Command Injection (CWE‑78).

BentoML versions up to and including 1.4.39 are affected. The flaw exists in the legacy base.j2 Dockerfile template used by the containerization tool. The impact is limited to systems that generate Docker images using BentoML's containerize command with potentially untrusted bentofile.yaml or bento archives.

The CVSS score of 8.5 indicates high severity. The EPSS score is not available, so the likelihood of real-world exploitation cannot be quantified, but the vulnerability is not listed in the CISA KEV catalog. The attack requires the ability to supply a custom bentofile.yaml or bento archive to the containerize process, which may occur if an organization imports untrusted projects or uses unvalidated artifacts. An attacker who succeeds can execute arbitrary RUN instructions during image build, potentially exfiltrating secrets or inserting malicious software into the image. Therefore, the risk is high for environments that build images from untrusted sources.